5.1.0 accepts versionType semver for non-semver data #263
Labels
bug
Something isn't working
Needs Discussion
Discuss in a future QWG meeting or on mailing list
section:affected_product
Schema location is affected or product
At the 2023-12-14 TWG meeting, the discussion suggested that, during testing of the 5.1.0 schema, any CVE Record that validated even though the record format was not "intended" would be considered a "loophole."
As far as I know, it was not intended that a provider use
"versionType":"semver"
if the value of the version property does not comply with the https://semver.org specification. The one exception is that the value of the version property can be "0" because this is defined by https://github.com/CVEProject/cve-schema/blob/master/schema/v5.0/docs/versions.md to mean "no lower bound."minimal/plausible test case (the CNA uses "1" where "1.0.0" is required by the semver specification)
possible solution: if the versionType is semver, set the pattern for version to the bottom regular expression on https://semver.org with the exception that "0" is allowed, i.e., add this:
issues on the current CVE List (many CNAs use "semver" with a "version" field that doesn't comply with the semver specification)
count per CNA
The text was updated successfully, but these errors were encountered: